Every access review I run turns up the same shape of problem. Not a zero-day. Not a sophisticated adversary. An account belonging to someone who left the company, still active, still a member of a group that grants production database access.
Why it accumulates
Offboarding is usually treated as an HR event with an IT side-effect. Someone files a ticket, the primary account gets disabled, and the long tail (the SaaS tools bought on a department card, the service account created “temporarily”, the group membership granted for a project that ended) survives untouched.
The result is an access surface that only ever grows. Nobody is responsible for shrinking it, because shrinking it has no deadline.
What actually fixes it
- Make the HR system authoritative. Termination in the HR record should trigger deprovisioning automatically across every connected application. Manual offboarding checklists decay within two quarters.
- Time-box every grant. Access granted for a project expires when the project does. Default expiry beats periodic review, because expiry is enforced by the system rather than by someone’s calendar.
- Own your service accounts. Every non-human identity needs a named human owner and a documented purpose. Ones that fail that test get disabled, not documented.
- Review by exception. Quarterly certification campaigns that ask managers to approve 200 entitlements produce rubber-stamping. Surface only what changed, or what looks anomalous.
The uncomfortable measurement
Pick a random employee who left six months ago. Trace every system they could still reach today. The number is almost never zero, and the exercise is more persuasive to a board than any maturity score.